Jenkins allows Unauthorized Viewing of Queue API Information

MEDIUM 5.0CVE-2015-5324 · GHSA-5xmf-9vgr-53mj · Published 25/11/2015 · updated 17/06/2026

In short

CVE-2015-5324 is a MEDIUM (CVSS 5.0) vulnerability affecting org.jenkins-ci.main:jenkins-core, jenkins (jenkins), openshift (redhat).
Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 81.4% of all vulnerabilities.
Fix: update to 1.638, 1.625.2 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-core Maven	`≥ 1.626, < 1.638< 1.625.2`	`1.6381.625.2`
jenkins jenkins	`≤ 1.625.1≤ 1.637`	No fix yet
openshift redhat	`= 2.0≤ 3.1`	No fix yet

Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.

NVD description

Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Maven

≥ 1.626, < 1.638< 1.625.2

1.6381.625.2

≤ 1.625.1≤ 1.637

No fix yet

= 2.0≤ 3.1

No fix yet

More vulnerabilities in org.jenkins-ci.main:jenkins-core

See all →